Routing rules not working for Portal/Bridge

[AGluk]

Hello everybody!
Try to setup Xray for reverse proxy operation.

Server config:

{
    "reverse": {
      "portals": [
        {
            "tag": "portal",
            "domain": "reverse.mydomain.com"
        }
      ]
    },
    "inbounds": [
        {
            "tag": "vless",
            ...
        }
    ],
    "outbounds": [
        {
            "tag": "direct",
            "protocol": "freedom"
        }
    ],
    "routing": {
        "rules": [
            {
                "inboundTag": [
                    "vless"
                ],
                "outboundTag": "portal",
                "type": "field",
                "ip": [
                    "192.168.0.0/24",
                    "192.168.200.0/22"
                ]
            }
        ]
    }
}

Bridge config:

{
    "reverse": {
        "bridges": [
            {
                "tag": "bridge",
                "domain": "reverse.mydomain.com"
            }
        ]
    },
    "inbounds": [
        {
            "tag": "socks",
            ...
        }
    ],
    "outbounds": [
        {
            "tag": "proxy",
            "protocol": "vless",
            ...
        },
        {
            "tag": "direct",
            "protocol": "freedom"
        }
    ],
    "routing": {
        "rules": [
            {
                "inboundTag": [
                    "bridge"
                ],
                "outboundTag": "proxy",
                "type": "field",
                "domain": [
                    "full:reverse.mydomain.com"
                ]
            },
            {
                "inboundTag": [
                    "bridge"
                ],
                "outboundTag": "direct",
                "type": "field"
            }
        ]
    }
}

With such configuration I don't have access to local subnet over the Bridge.
But if the Routing section on Server make unconditional:

"routing": {
    "rules": [
        {
            "inboundTag": [
                "vless"
            ],
            "outboundTag": "portal",
            "type": "field"
        }
    ]
}

then I have access to local network over the Bridge.
But I need only two subnets to route over Portal/Bridge and all other traffic over Server direct connection.
What I do wrong?
Thank you!

[nikkymen]

I confirm that this configuration does not work and I am also looking for a solution.

[nikkymen]

I found a solution using the user field in the routing rules.

If you want to use your server (portal) inbound for external users, you should have at least two clients for it - one for bridge and one for external user:

"inbounds": [
  {
    "tag": "vless",
    "protocol": "vless",
    "listen": "0.0.0.0",
    "port": 443,
    "settings": {
      "clients": [
        {
          "id": "8io6771",
          "email": "bridge-user",
          "flow": "xtls-rprx-vision"
        },
        {
          "id": "8io6772",
          "email": "external-user",
          "flow": "xtls-rprx-vision"
        }
      ],
      "decryption": "none"
    }
  }
]

Then you can write rules on server (portal) like this:

  "routing": {
    "rules": [
      {
        "type": "field",
        "user": "bridge-user",
        "inboundTag": ["vless"],
        "outboundTag": "portal"
      },
      {
        "type": "field",
        "user": "external-user",
        "inboundTag": ["vless"],
        "ip": [
          "192.168.0.0/24",
          "192.168.200.0/22"
        ],
        "outboundTag": "portal"
      },
      {
        "type": "field",
        "user": "external-user",
        "inboundTag": ["vless"],
        "outboundTag": "direct"
      }
    ]
  }

On the bridge side you must use bridge-user id for outbound :

{
    "tag": "proxy""protocol": "vless",
    "settings": {
        "vnext": [
            {
                "address": "myserver.com",
                "port": 443,
                "users": [
                    {
                        "id": "8io6771", // <----- bridge-user
                        "flow": "xtls-rprx-vision",
                        "encryption": "none"
                    }
                ]
            }
        ]
    }
}

Thats it - the secret is that you need a dedicated user for bridge - portal communication.
There may be other ways to accomplish this task.